crobb305 - 10:57 pm on Apr 7, 2011 (gmt 0)

SSL is not needed unless you have some kind of privacy or online transaction on the site. HTTPS is often only "engaged" when on the "privacy" part of the web site - ie entering personal/card payment or similar details.

Good points, but none of them really negate the fact that SSL certificates, particularly from companies that perform strict verification, can add credibility/trust to a site (algorithmically and to human visitors). I had to prove that my business was registered with the State or incorporated to get my SSL cert from Verisign -- short of giving a blood sample, it was a strict verification...they don't just hand them out like candy when you have SSL installed on your server. Again, I point to the Microsoft website credibility study. They specifically discuss 3rd party certifications and awards as a sign of trust and potential ranking signal. An SSL certificate fits into that category.

We can debate the merits of SSL certification all day, but as algorithms add more and more trust/quality-detection signals, there is no reason to believe that SSL certificates couldn't help. It would be just ONE sign of quality, not the be-all and end-all, and certainly not all sites "need" to have one, but I, along with many other consumers, expect to see SSL and trusted certification when I do business with any e-commerce site.

Read the Google blog entry that Engine provided above. Google wouldn't be keeping a catalog of valid SSL certificates just for kicks. They just might be using them as a quality signal. The article also mentions the Comodo security breech that you mentioned.

There is no reason why (eg) a virus-serving site, scammer or content thief cannot obtain a valid certificate.

This is true, particularly if the verification process is lax. This is why some certificates would be more trusted than others. Some companies will provide them as long as you have a valid CSR. Other companies will call to verify the number, verify the whois, and verify company/business registration.